Skip to content

ROX-31227: Only allow scheduling equivalent TPs across clusters#19545

Draft
guzalv wants to merge 3 commits intomaster-base/gualvare/ROX-31227-add-tp-equivalence-hashfrom
master-base/gualvare/ROX-31227-only-schedule-equivalent-tps
Draft

ROX-31227: Only allow scheduling equivalent TPs across clusters#19545
guzalv wants to merge 3 commits intomaster-base/gualvare/ROX-31227-add-tp-equivalence-hashfrom
master-base/gualvare/ROX-31227-only-schedule-equivalent-tps

Conversation

@guzalv
Copy link
Contributor

@guzalv guzalv commented Mar 23, 2026

This commit was mostly generated by Claude Sonnet 4.6, after providing
it with a detailed implementation plan which was joint work between
human author and Claude Opus 4.6.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

Description

change me!

User-facing documentation

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added compatibility tests
  • added regression tests
  • modified existing tests

How I validated my change

change me!

@openshift-ci
Copy link

openshift-ci bot commented Mar 23, 2026

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

Copy link
Contributor

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've found 2 issues, and left some high level feedback:

  • There are unresolved merge conflict markers in central/complianceoperator/v2/compliancemanager/manager_impl.go (<<<<<<< HEAD / ======= / >>>>>>> …) that need to be resolved before merging.
  • The tailored-profile equivalence logic is now implemented in both the datastore (resolveEligibleProfileNames/hash checks) and the manager (validateTailoredProfileHashConsistency), which risks future drift; consider centralizing this hash-consistency logic in a shared helper to keep behavior aligned.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- There are unresolved merge conflict markers in central/complianceoperator/v2/compliancemanager/manager_impl.go (<<<<<<< HEAD / ======= / >>>>>>> …) that need to be resolved before merging.
- The tailored-profile equivalence logic is now implemented in both the datastore (resolveEligibleProfileNames/hash checks) and the manager (validateTailoredProfileHashConsistency), which risks future drift; consider centralizing this hash-consistency logic in a shared helper to keep behavior aligned.

## Individual Comments

### Comment 1
<location path="central/complianceoperator/v2/compliancemanager/manager_impl.go" line_range="582-591" />
<code_context>
+<<<<<<< HEAD
</code_context>
<issue_to_address>
**issue (bug_risk):** Unresolved merge conflict markers must be resolved before merge

In this file, there are still `<<<<<<<`, `=======`, and `>>>>>>>` markers around the tailored profile validation logic. Select the correct version of the code, remove the markers, and ensure the file compiles before merging.
</issue_to_address>

### Comment 2
<location path="sensor/kubernetes/complianceoperator/dispatchers/complianceoperatortailoredprofiles.go" line_range="132-138" />
<code_context>
 			OperatorKind: central.ComplianceOperatorProfileV2_TAILORED_PROFILE,
 		}

+		var ruleNames []string
 		for _, rule := range protoProfile.GetRules() {
 			protoProfileV2.Rules = append(protoProfileV2.Rules, &central.ComplianceOperatorProfileV2_Rule{RuleName: rule.GetName()})
+			ruleNames = append(ruleNames, rule.GetName())
 		}

+		protoProfileV2.EquivalenceHash = computeProfileEquivalenceHash(
+			tailoredProfile.GetName(),
+			tailoredProfile.GetNamespace(),
</code_context>
<issue_to_address>
**question (bug_risk):** Equivalence hash ignores some potentially relevant fields (e.g., values)

The hash currently covers only name, namespace, description, title, and rule names. If other fields (such as values/variables that influence rule evaluation) affect profile behavior, differences in those fields will be ignored. If tailored profile values are behaviorally significant, they should also be included in the hash so non-equivalent tailored profiles aren’t treated as equivalent across clusters.
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@guzalv guzalv force-pushed the master-base/gualvare/fix-compliance-custom-rules-gotchas branch from c921c4d to f9bb406 Compare March 23, 2026 22:21
@guzalv guzalv force-pushed the master-base/gualvare/ROX-31227-only-schedule-equivalent-tps branch from 591e8b1 to 7fac849 Compare March 23, 2026 22:22
@rhacs-bot
Copy link
Contributor

rhacs-bot commented Mar 23, 2026

Images are ready for the commit at e32a710.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-440-ge32a71079a.

@guzalv guzalv changed the base branch from master-base/gualvare/fix-compliance-custom-rules-gotchas to master-base/gualvare/ROX-31227-add-tp-equivalence-hash March 24, 2026 08:40
@guzalv guzalv force-pushed the master-base/gualvare/ROX-31227-only-schedule-equivalent-tps branch from 7fac849 to bc2fe41 Compare March 24, 2026 08:40
@guzalv guzalv force-pushed the master-base/gualvare/ROX-31227-only-schedule-equivalent-tps branch from bc2fe41 to e32a710 Compare March 24, 2026 10:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants